Data protection complaints procedure

Procedure overview

How to complain

A person may complain to Northfield Services Ltd through any reasonable channel. They do not have to use a particular form.

Tell us if you need information in another format, an interpreter or another reasonable adjustment.

1. Purpose

This procedure explains how Northfield Services Ltd receives, investigates and responds to complaints from people who consider that our handling of their personal information may have infringed UK data protection law.

It provides a consistent, fair and documented process and supports evidence of the enquiries, decisions and actions taken.

It must be read with the organisation's rights-request, personal data breach, retention, safeguarding and relevant sector procedures.

2. Scope

This procedure applies where a data subject considers that, in connection with personal data relating to them, there is an infringement of the UK GDPR or Part 3 of the Data Protection Act 2018.

It covers complaints from customers, workers, former workers, job applicants, website visitors, suppliers, service users and other people whose personal information Northfield Services Ltd handles as controller, including complaints made by an authorised representative.

A complaint may be oral or written and may arrive through any reasonable channel. It does not need to use the word complaint or quote legislation.

General service complaints, worker grievances, whistleblowing disclosures, freedom of information requests and sector complaints follow their own routes. Any data protection element remains linked and is handled under this procedure without unjustified delay.

A communication may also contain a data rights request, personal data breach, safeguarding issue, fraud concern or legal claim. Each applicable process keeps its own record, owner and timetable.

3. Legal and regulatory framework

Section 164A of the Data Protection Act 2018 is the core complaint-handling provision. The related provisions below apply only where the facts engage them.

The controller must facilitate complaints, acknowledge receipt within 30 days, take appropriate steps to respond without undue delay, make enquiries to the extent appropriate, keep the complainant informed and communicate the outcome.

The organisation must not treat the time limit for a data rights request as the final-response deadline for a complaint.

4. Definitions

5. Roles and responsibilities

Roles must be tailored to the organisation. A role described as a Data Protection Officer must retain the independence and reporting arrangements required for a formally appointed DPO.

All staff must be able to recognise a possible data protection complaint and know where to send it.

The complaint owner identifies and records any actual or perceived conflict. Where practicable, a person materially involved in the subject matter does not approve the outcome.

6. How complaints can be made

Northfield Services Ltd provides clear ways for people to make data protection complaints directly to us.

A person may use our complaint form, but does not have to. We accept complaints through any reasonable channel, including when first raised with a member of staff.

A verbal complaint is recorded in the person's own words and, where practicable, the summary is confirmed with them.

Anonymous complaints are considered where there is enough information to make appropriate enquiries, but anonymity may limit the investigation or the outcome information we can provide.

If a complaint reaches us through social media, we ask for an alternative contact method before discussing personal information.

Tell us if you need another format, interpretation, language assistance, help using a complaint route or another reasonable adjustment.

A family member, solicitor, advocate or another representative may complain for someone else. We ask for proportionate evidence that they are authorised to act.

7. Triage and risk assessment

Triage starts on receipt and does not wait for the acknowledgement. Urgent containment and linked legal clocks are opened immediately where needed.

A severity rating supports prioritisation and oversight. It does not determine whether the law was infringed or replace a fact-specific investigation.

8. Timeframes

We acknowledge receipt of a data protection complaint within 30 days.

Day 1 is the calendar day after receipt. If the 30th calendar day falls on a weekend or relevant public holiday, the acknowledgement deadline moves to the next working day.

We make appropriate enquiries, keep the complainant informed and communicate the outcome without undue delay. There is no standard one-month final-response deadline or two-month complaint extension.

Any shorter acknowledgement target or progress cadence is an internal control and must not delay action that can reasonably be completed sooner.

Where representative authority is required and has not been established, we acknowledge receipt but do not begin substantive investigation until suitable evidence is received.

9. Investigation

We make enquiries into the complaint to the extent appropriate and without undue delay. The investigation begins when the complaint is received.

The nature and extent of the investigation depend on the circumstances, including complexity, scale, available evidence and any continuing harm.

The investigator distinguishes established facts, conflicting evidence and unresolved uncertainty, and records reasons for each finding.

Legal privilege is assessed only by an authorised legal reviewer. Routine complaint documents are not labelled privileged merely because a legal issue may arise.

• Review each complaint point thoroughly, fairly and accurately.
• Compare the complaint with the records held by the organisation.
• Speak to relevant staff and check applicable policies, notices, decisions and system records.
• Preserve relevant evidence and maintain a chronology of enquiries and decisions.
• Escalate a conflict where the complaint concerns the investigator, decision-maker or senior staff.

10. Outcome and response

When the investigation is complete, we inform the complainant of the outcome without undue delay.

The outcome addresses each complaint point, explains the enquiries made and gives enough information for the person to understand the conclusion.

Where appropriate, each point is recorded as upheld, partly upheld, not upheld, withdrawn or out of scope.

If the complainant seeks compensation, the matter is referred to the authorised legal or claims process. This procedure does not determine legal entitlement or the amount of compensation.

The outcome should include

1. Case reference and outcome date
2. Each complaint point and the finding reached
3. A concise account of the enquiries and evidence considered
4. Facts established, material uncertainty and reasons for the conclusion
5. Action completed or planned, including owners and target dates where relevant
6. Any separate rights-request, breach or sector-process status
7. Any internal review route
8. Information about complaining to the ICO
9. The contact point for questions about the outcome

11. Escalation and external rights

A person may complain to the Information Commissioner's Office at any time. They do not have to complete an internal review first.

The ICO suggests raising the matter within three months of the organisation's final response because delay may affect how it handles the complaint. This is not described as a statutory deadline.

Where an internal review is offered, it is conducted by a person who was not the original decision-maker where practicable, within the organisation's stated target.

The complainant may also have rights to seek a court remedy or compensation. The outcome signposts independent legal advice and does not state that an entitlement or amount has been established.

12. Recording and the complaints register

We keep a clear record from first receipt to closure so that we can show what we did and why.

The complaint file is itself personal data. The organisation records its lawful basis, any additional condition for sensitive data, access restrictions, privacy information and justified retention rule before operating this procedure.

We do not keep personal information for longer than necessary. Each case has a retention review date and disposal outcome under the approved retention schedule.

Minimum case record

• First receipt date, time and channel
• The complaint in the person's own words
• Separate complaint points and the outcome sought
• Contact preference and accessibility requirements
• Identity and representative authority checks where required
• Triage rating and linked breach, rights, safeguarding, legal or sector records
• Acknowledgement date, method and delivery evidence
• Investigation plan, enquiries and evidence references
• Progress updates and material communications
• Findings, reasons, decision approval and conflicts
• Outcome communication and delivery evidence
• Root cause, corrective actions, owners and completion evidence
• Closure date, retention review date and disposal outcome

13. Root cause analysis and continuous improvement

After the outcome, we consider what can be learned or improved to prevent future complaints.

A documented root-cause review is required for upheld, repeated, significant or critical complaints. Corrective and preventive actions have named owners, due dates and completion evidence.

Where relevant, learning is fed into the risk register, DPIA reviews, policies, privacy information, system design, supplier oversight and training.

14. Reporting and metrics

We review complaint volumes, recurring themes and lessons learned to identify potential compliance issues and areas for improvement.

Reporting uses aggregated information where possible and does not include unnecessary case details. Reporting cadence and audiences are approved by the organisation.

Monitoring measures

• Complaints received by channel, data subject category and theme
• Acknowledgements sent by the adjusted deadline
• Open complaints, age profile and average or median time to outcome
• Outcomes and upheld or partly upheld rate
• Complaints linked to personal data breaches
• Internal reviews, ICO escalations and sector referrals
• Repeated root causes and control failures
• Overdue corrective actions and unresolved material risks
• Training and complaint-route test completion

15. Confidentiality and no detriment

No person suffers retaliation or avoidable disadvantage because they raised a data protection concern in good faith.

Complaint information is shared only where needed to investigate, decide, oversee or comply with legal obligations. The organisation explains any material limit on confidentiality.

Anonymous complaints are considered where sufficient information is available, but anonymity may limit enquiries or feedback.

16. Rights-request exceptions and difficult communications

The manifestly unfounded or excessive provisions in Article 12(5) apply to requests made under the relevant data subject rights provisions. They do not remove the section 164A complaint duties.

A communication that also contains a data rights request is separated into linked records. Any Article 12(5) decision applies to the rights request only and requires its own evidence, approval and response.

A complaint that is repetitive, burdensome, hostile or considered unfounded is still acknowledged. We make enquiries to the extent appropriate and are not required to take unreasonable or disproportionate steps.

Communication restrictions address safety or conduct proportionately and preserve an effective route for the data protection complaint.

17. Processors, joint controllers and third parties

Where a joint controller receives a complaint, the original receipt date is preserved and the transparent arrangement is used to coordinate the investigation and communication.

Processors must follow the agreed route to forward complaints, preserve relevant evidence and provide information needed by the controller. The controller remains responsible for the complaint obligations.

Information shared for an investigation is limited to what is necessary and uses an approved secure route. International-transfer or sector concerns are referred to the relevant specialist process.

18. Training and awareness

Staff receive enough training to recognise a data protection complaint and know where to send it.

People with complaint responsibilities receive role-specific training on acknowledgement, triage, identity, representatives, investigation, progress, outcomes and record keeping.

Completion, missed training, competence checks and remedial action are recorded. Published routes and absence cover are tested at planned intervals.

19. Monitoring, review and assurance

The document owner reviews this procedure at least annually and sooner after a material legal, regulatory, organisational, channel, incident or assurance change.

Assurance includes sample case-file review, route testing, deadline-calculator testing, corrective-action tracking and confirmation that official sources remain current.

Findings, owners, due dates and completion evidence are reported through the organisation's approved governance route.

Monitoring measures

• Current approved version is available and obsolete versions are controlled
• Every public channel is reachable and has absence and business-continuity cover
• A sample of case files contains receipt, acknowledgement, enquiries, progress, outcome and closure evidence
• The calculator uses the selected UK bank-holiday region and active rule-pack version
• Official sources have a review date, change history and next scheduled review
• Overdue corrective actions and unresolved material risks are escalated
• Training, route tests and assurance actions are complete

Source register and document scope

The following sources were reviewed 6 August 2026.

1. UK Parliament
   Data Protection Act 2018, section 164A
   Complaints by data subjects to controllers
   Reviewed 6 August 2026
2. UK Parliament
   Data (Use and Access) Act 2025, section 103
   Insertion of sections 164A and 164B into the Data Protection Act 2018
   Reviewed 6 August 2026
3. Information Commissioner's Office
   What are data protection complaints?
   Reviewed 6 August 2026
4. Information Commissioner's Office
   How do we prepare to handle data protection complaints?
   Reviewed 6 August 2026
5. Information Commissioner's Office
   What do we do when we receive a complaint?
   Reviewed 6 August 2026
6. Information Commissioner's Office
   What do we do after we have finished our investigation?
   Reviewed 6 August 2026
7. GOV.UK
   UK bank holidays
   Reviewed 6 August 2026